Skip to content
CyclepediaThe trading encyclopedia
ITENESPT-BRFRDE

Wallet drainer: how it works

A wallet drainer tricks the user into authorising a transaction or permission that can transfer tokens or NFTs without exposing the seed phrase.

On this page

In simple terms — A wallet drainer is a malicious flow that tricks a user into signing or approving something that lets an attacker transfer certain assets. It abuses a granted authorisation and does not necessarily require compromised keys.

The lure may be an airdrop, an NFT collection, technical support, or a cloned dApp. Connecting a wallet on its own normally reveals the address and lets the site propose requests; it does not yet authorise spending. Risk changes when transactions, signatures, or spending permissions (permits or allowances) are confirmed without understanding their recipient and scope.

From signature to transfer

Token approvals are necessary in legitimate dApps too: they allow a smart contract to use an amount of tokens or a specific set of assets. These approvals become dangerous when the spender is malicious, the amount is excessive, or the request hides its real effect. An off-chain signature may also be stored and used later, so the lack of an immediate transfer does not prove that the interaction was harmless.

Wallet drainer: connection and permission differ Follow the flow, identify the decisive action, verify through a known channel. dApp lure, Connection, Signature or approval, Revoke and secure. OPERATIONAL MAP Wallet drainer: connection and permission differ Follow the flow, identify the decisive action, verify through a known channel dApp lure: An attractive page asks to connect the wallet and frames the request as necessary to receive or protect assets. 1 dApp lure Airdrop, NFT, or cloned support Connection: Connecting lets the site make requests and view the address, but normally does not yet authorise a transfer. 2 Connection Address visible, no spending by itself Signature or approval: Confirmation may grant a persistent permission or a signature that the authorised party can use later. 3 Signature or approval Spender, asset, amount, and duration Revoke and secure: Disconnecting the dApp does not remove allowances; an exposed seed instead requires new keys and migration. 4 Revoke and secure Revoke separately, new wallet if needed Tab or tap: explore the four stages Cyclepedia diagram · Emiciclo
Connecting, signing, and granting an allowance are different actions: read the confirmation before approving.
Select the highlighted points to explore the detail

A drainer does not necessarily require a seed phrase or gain access to every asset: the outcome depends on the network, signed message, and permissions granted. Seed phrase theft instead compromises derived keys and needs another response. Disconnecting a dApp from a wallet also does not revoke allowances already recorded on the blockchain.

Checks, revocation, and securing the wallet

Disconnecting the wallet or dApp does not revoke a malicious approval: revocation is a separate operation. Before confirming, inspect the domain, network, contract, spender, asset, amount, and duration of the authorisation. An unlimited approval is not automatically fraud, but it increases potential harm and should be granted only when needed by a verified application. Use tools named by the wallet or an official explorer: a revocation site found through an advert can itself be a lure.

If you suspect a malicious approval, stop the interaction, revoke the affected permissions, and consider moving remaining assets to a safe wallet. Preserve the domain, addresses, and transaction hashes. If the seed phrase was exposed, revocation alone is insufficient: a new wallet with a new phrase is required. Revocation does not undo confirmed transactions, so acting quickly may limit what follows but does not automatically recover transferred assets.

Sources

Anti-scam · Red flags · Phishing · Seed phrase theft · Clone website

Suggest an edit My proposals